COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies

Source

Source name: arXiv
Source kind: paper
Authors / organization: Chen Frydman, Aviram Zilberman, Rubin Krief, Abed Showgan, Andres Murillo, Sekiya Motoyoshi, Asaf Shabtai, Yuval Elovici, Rami Puzis
Venue: arXiv: cs.NI
Published: 2026-06-29
Collected: 2026-06-30
URL: http://arxiv.org/abs/2606.30479v1
PDF: https://arxiv.org/pdf/2606.30479v1
DOI: UNKNOWN

Plain-Language Brief

The COHORT framework is an automated solution that aims to mitigate cyber attacks in enterprise networks more efficiently. It uses a multi-agent system and a high-fidelity GNS3 emulator to generate, implement, and refine potential solutions through a critique loop. The solutions are evaluated by re-executing the original attack on the mitigated network. In tests across three topologies and four attack scenarios, 46.7% of generated mitigations were successful in disrupting attacks without affecting legitimate network connectivity, which is 4.4 times more than a single-agent baseline.

What the Document Says

COHORT is an automated end-to-end framework for creating deployable mitigations against cyber attacks in enterprise networks.
It uses a role-decomposed multi-agent LLM workflow to propose, implement, and refine potential solutions on a high-fidelity GNS3 emulator running real vendor firmware.
The solutions are evaluated by offensive replay, which involves re-executing the original attack on the mitigated network.
Two additional checks complement replay: connectivity-regression check and cumulative evaluation.
Across three topologies and four attack scenarios, 46.7% of generated mitigations successfully disrupted attacks without affecting legitimate network connectivity.
This is 4.4 times more than the rate of a single-agent baseline using the same model and tool access.

Key Concepts Mentioned

COHORT framework
cyber attack mitigation
enterprise networks
multi-agent system
high-fidelity GNS3 emulator
offensive replay
connectivity-regression check
cumulative evaluation

Claims Made by the Document

COHORT can automate the process of creating mitigations for cyber attacks in enterprise networks.
The generated mitigations are successful in disrupting attacks without affecting legitimate network connectivity at a higher rate than a single-agent baseline.

Evidence Used

46.7% success rate of generated mitigations in tests across three topologies and four attack scenarios

Methods / Approach

multi-agent LLM workflow
offensive replay
connectivity-regression check
cumulative evaluation

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Mitigating an observed adversary in an enterprise network typically takes weeks of expert work: an analyst derives a mitigation tailored to that adversary, validates it without breaking production, and verifies it disrupts the specific attack. The procedure relies on expert judgment and cannot safely be exercised against the production network. COHORT is the first end-to-end framework to automate this procedure for deployable mitigations. A role-decomposed multi-agent LLM workflow proposes candidates, implements them as real device commands, and refines them through a critique loop, all on a high-fidelity GNS3 emulator running real vendor firmware (firewall, switch, router). Each candidate is evaluated by offensive replay: re-executing the original adversary on the mitigated network for a paired comparison against the unmitigated baseline, rather than the reward-signal or expert-judgment proxies used in prior simulation, hybrid, and configuration-generation work. Two further checks complement replay: a connectivity-regression check (LAN ping and internet HTTP probe) rejects mitigations that disrupt legitimate LAN or internet connectivity, and a cumulative evaluation stacks approved mitigations onto a persistent state to surface compound effects. Across three topologies and four attack scenarios (ransomware, lateral movement, DNS exfiltration, data theft), 46.7% of generated mitigations both disrupt the attack and preserve connectivity under replay, 4.4 times the rate of a single-agent baseline using the same model and tool access. A demo video walking through the framework is available with our released artifacts.